{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"48ac9e2d-7066-4549-ac02-8a7a26a91aef","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27229981-260f-44d8-842a-8ca018654267","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:59230","PortSpecifier":{"PortValue":59230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"27229981-260f-44d8-842a-8ca018654267","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27229981-260f-44d8-842a-8ca018654267","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:59230","PortSpecifier":{"PortValue":59230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690469,"nanos":850030779},"http":{"id":"27229981-260f-44d8-842a-8ca018654267","method":"POST","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"27229981-260f-44d8-842a-8ca018654267","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"27229981-260f-44d8-842a-8ca018654267","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"27229981-260f-44d8-842a-8ca018654267","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27229981-260f-44d8-842a-8ca018654267","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27229981-260f-44d8-842a-8ca018654267","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27229981-260f-44d8-842a-8ca018654267","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/rate-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"27229981-260f-44d8-842a-8ca018654267","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27229981-260f-44d8-842a-8ca018654267","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27229981-260f-44d8-842a-8ca018654267","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27229981-260f-44d8-842a-8ca018654267","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27229981-260f-44d8-842a-8ca018654267","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39660","PortSpecifier":{"PortValue":39660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","method":"POST","path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39660","PortSpecifier":{"PortValue":39660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690469,"nanos":903387745},"http":{"id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qVOXn4skCor7LYXq_4AevniC2gwIuyDl7LM0tpXkyiIJrg026t3lusKPVZOL"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qVOXn4skCor7LYXq_4AevniC2gwIuyDl7LM0tpXkyiIJrg026t3lusKPVZOL\"}"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","keyName":"e2e-rate-a-e3082e","subscription":"e2e-rate-iso-a-e3082e","tenant":"e2e-shared-a-7266ad","userId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\",\"requestedSubscription\":\"e2e-rate-iso-a-e3082e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3082e","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e3082e"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","keyName":"e2e-rate-a-e3082e","selected_subscription":"e2e-rate-iso-a-e3082e","selected_subscription_key":"ai-tenant-e2e-shared-a-7266ad/e2e-rate-iso-a-e3082e@ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3082e","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c6c5ea2b-3471-46ae-914c-108b3cc52d92","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d4929bec-5813-4049-90bd-055f204a4d65","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39672","PortSpecifier":{"PortValue":39672}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d4929bec-5813-4049-90bd-055f204a4d65","method":"POST","path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d4929bec-5813-4049-90bd-055f204a4d65","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39672","PortSpecifier":{"PortValue":39672}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690470,"nanos":963943034},"http":{"id":"d4929bec-5813-4049-90bd-055f204a4d65","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qVOXn4skCor7LYXq_4AevniC2gwIuyDl7LM0tpXkyiIJrg026t3lusKPVZOL"}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qVOXn4skCor7LYXq_4AevniC2gwIuyDl7LM0tpXkyiIJrg026t3lusKPVZOL\"}"}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","keyName":"e2e-rate-a-e3082e","subscription":"e2e-rate-iso-a-e3082e","tenant":"e2e-shared-a-7266ad","userId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\",\"requestedSubscription\":\"e2e-rate-iso-a-e3082e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3082e","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d4929bec-5813-4049-90bd-055f204a4d65","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e3082e"}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d4929bec-5813-4049-90bd-055f204a4d65","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","keyName":"e2e-rate-a-e3082e","selected_subscription":"e2e-rate-iso-a-e3082e","selected_subscription_key":"ai-tenant-e2e-shared-a-7266ad/e2e-rate-iso-a-e3082e@ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3082e","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d4929bec-5813-4049-90bd-055f204a4d65","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d4929bec-5813-4049-90bd-055f204a4d65","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39686","PortSpecifier":{"PortValue":39686}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","method":"POST","path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39686","PortSpecifier":{"PortValue":39686}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690472,"nanos":1043424},"http":{"id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qVOXn4skCor7LYXq_4AevniC2gwIuyDl7LM0tpXkyiIJrg026t3lusKPVZOL"}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qVOXn4skCor7LYXq_4AevniC2gwIuyDl7LM0tpXkyiIJrg026t3lusKPVZOL\"}"}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","keyName":"e2e-rate-a-e3082e","subscription":"e2e-rate-iso-a-e3082e","tenant":"e2e-shared-a-7266ad","userId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\",\"requestedSubscription\":\"e2e-rate-iso-a-e3082e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3082e","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e3082e"}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fdd4c28b-4e00-49da-bc7d-ef0ee9e2a065","keyName":"e2e-rate-a-e3082e","selected_subscription":"e2e-rate-iso-a-e3082e","selected_subscription_key":"ai-tenant-e2e-shared-a-7266ad/e2e-rate-iso-a-e3082e@ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e3082e","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84ed8bb1-c024-41eb-beb7-50bd687c5d8b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:55078","PortSpecifier":{"PortValue":55078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:55078","PortSpecifier":{"PortValue":55078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690486,"nanos":508774193},"http":{"id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d4a81b4-ab58-450b-88f3-c0b13be271d9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:54134","PortSpecifier":{"PortValue":54134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:54134","PortSpecifier":{"PortValue":54134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690486,"nanos":547492964},"http":{"id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","method":"POST","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/rate-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d2b19909-ee8d-465b-adc0-f2a7cae98f8c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:55084","PortSpecifier":{"PortValue":55084}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","method":"POST","path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:55084","PortSpecifier":{"PortValue":55084}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690486,"nanos":580435303},"http":{"id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1A83h6hfFclWL9ojc_D4vwsHTZvYKnI63UcHA2WkkXZkurVcTiRKEijvgShuF"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1A83h6hfFclWL9ojc_D4vwsHTZvYKnI63UcHA2WkkXZkurVcTiRKEijvgShuF\"}"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","keyName":"e2e-rate-a-db18bb","subscription":"e2e-rate-iso-a-db18bb","tenant":"e2e-shared-a-7266ad","userId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\",\"requestedSubscription\":\"e2e-rate-iso-a-db18bb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-db18bb","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-db18bb"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","keyName":"e2e-rate-a-db18bb","selected_subscription":"e2e-rate-iso-a-db18bb","selected_subscription_key":"ai-tenant-e2e-shared-a-7266ad/e2e-rate-iso-a-db18bb@ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-db18bb","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0ce0bf7d-0473-414e-a3a3-14ced78eaf70","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"db40c707-6a26-401d-82b9-c0284c973086","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44426","PortSpecifier":{"PortValue":44426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"db40c707-6a26-401d-82b9-c0284c973086","method":"POST","path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"db40c707-6a26-401d-82b9-c0284c973086","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44426","PortSpecifier":{"PortValue":44426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690487,"nanos":726979936},"http":{"id":"db40c707-6a26-401d-82b9-c0284c973086","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1A83h6hfFclWL9ojc_D4vwsHTZvYKnI63UcHA2WkkXZkurVcTiRKEijvgShuF"}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1A83h6hfFclWL9ojc_D4vwsHTZvYKnI63UcHA2WkkXZkurVcTiRKEijvgShuF\"}"}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","keyName":"e2e-rate-a-db18bb","subscription":"e2e-rate-iso-a-db18bb","tenant":"e2e-shared-a-7266ad","userId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\",\"requestedSubscription\":\"e2e-rate-iso-a-db18bb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-db18bb","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"db40c707-6a26-401d-82b9-c0284c973086","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-db18bb"}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"db40c707-6a26-401d-82b9-c0284c973086","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","keyName":"e2e-rate-a-db18bb","selected_subscription":"e2e-rate-iso-a-db18bb","selected_subscription_key":"ai-tenant-e2e-shared-a-7266ad/e2e-rate-iso-a-db18bb@ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-db18bb","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"db40c707-6a26-401d-82b9-c0284c973086","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"db40c707-6a26-401d-82b9-c0284c973086","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44432","PortSpecifier":{"PortValue":44432}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"41f802a6-2b7a-4d72-a908-bd6430c71517","method":"POST","path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions","host":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44432","PortSpecifier":{"PortValue":44432}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690488,"nanos":765455847},"http":{"id":"41f802a6-2b7a-4d72-a908-bd6430c71517","method":"POST","headers":{":authority":"e2e-shared-a-7266ad.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1A83h6hfFclWL9ojc_D4vwsHTZvYKnI63UcHA2WkkXZkurVcTiRKEijvgShuF"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1A83h6hfFclWL9ojc_D4vwsHTZvYKnI63UcHA2WkkXZkurVcTiRKEijvgShuF\"}"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","keyName":"e2e-rate-a-db18bb","subscription":"e2e-rate-iso-a-db18bb","tenant":"e2e-shared-a-7266ad","userId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\",\"requestedSubscription\":\"e2e-rate-iso-a-db18bb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7266ad.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-db18bb","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-db18bb"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"da162a08-eb0f-4c3f-9ddc-6e31ab31d07a","keyName":"e2e-rate-a-db18bb","selected_subscription":"e2e-rate-iso-a-db18bb","selected_subscription_key":"ai-tenant-e2e-shared-a-7266ad/e2e-rate-iso-a-db18bb@ai-tenant-e2e-shared-a-7266ad/rate-test-model-7266ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7266ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-db18bb","namespace":"ai-tenant-e2e-shared-a-7266ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"41f802a6-2b7a-4d72-a908-bd6430c71517","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:53512","PortSpecifier":{"PortValue":53512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6e2552b5-4fea-4210-a39e-86dfa329a165","method":"POST","path":"/ai-tenant-e2e-shared-b-d5a846/rate-test-model-d5a846/v1/completions","host":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:53512","PortSpecifier":{"PortValue":53512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690488,"nanos":800542208},"http":{"id":"6e2552b5-4fea-4210-a39e-86dfa329a165","method":"POST","headers":{":authority":"e2e-shared-b-d5a846.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-d5a846/rate-test-model-d5a846/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UqFs4GuoLDPwhtYV_JZoOwtec92kqwFcax8IIpCmigCJ4oUvDrMl9oYW98aH"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-d5a846.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UqFs4GuoLDPwhtYV_JZoOwtec92kqwFcax8IIpCmigCJ4oUvDrMl9oYW98aH\"}"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d5a846.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8f60268e-a5a0-4d94-83f0-80f76c2f0cd1","keyName":"e2e-rate-b-db18bb","subscription":"e2e-rate-iso-b-db18bb","tenant":"e2e-shared-b-d5a846","userId":"8f60268e-a5a0-4d94-83f0-80f76c2f0cd1","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-d5a846.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-d5a846/rate-test-model-d5a846\",\"requestedSubscription\":\"e2e-rate-iso-b-db18bb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d5a846.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5a846","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-db18bb","namespace":"ai-tenant-e2e-shared-b-d5a846","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d5a846/rate-test-model-d5a846\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-db18bb"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8f60268e-a5a0-4d94-83f0-80f76c2f0cd1","keyName":"e2e-rate-b-db18bb","selected_subscription":"e2e-rate-iso-b-db18bb","selected_subscription_key":"ai-tenant-e2e-shared-b-d5a846/e2e-rate-iso-b-db18bb@ai-tenant-e2e-shared-b-d5a846/rate-test-model-d5a846","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5a846","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-db18bb","namespace":"ai-tenant-e2e-shared-b-d5a846","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:34:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e2552b5-4fea-4210-a39e-86dfa329a165","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6e9dcc7d166cfd409049d13767af6868bf7b1ecfed11aa019f940acef74f4943"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/89a227e27573e07b7390dceedd669d0af828350feb3ecead90eba86785d893fb"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3ea09e7c3a1293dbf1416fed044adcfd731543104a4afe7ce8907cf787e27e9b"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f6e7e31d1e240d42f59048e0da81ac6c935c0032c4a632c501a3421666e8109d"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0d9ab6029dd3fa2e199a1cb09f4d68bf02636a984d8aac843c79336fbd32ca21"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9daa0d752b6c4024e5a77dc3d83fd14d376e18e065323a2c695b1a6f75481efd"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5dc3fa6ae3fd37210f6a475b6a27b8fd8f9addc687fb073f1ec56775a7d71af4"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9f53638d914712c54d26e5179e750028178dfee8cd67fc888e148936f1652593"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c77303368b186a3f3bf11fc7df6213f2dda5ac0833f54336812ec82c7fdf8888"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c75ddac744d8e308a9bc81a62dbd8be6f61ea882c4e1b2aba94e867bbed17c7b"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a47e48d991348873729881030364a61627e4dc2e6691456c5a978a836ecf3ad0"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/42f6f626b45dfa1b1cd607d4fbeb58acc77e0b51c9303167ea859963d2d1c10c"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4b2f3088a9a7a2fbc71e49be333afdc711d0ba607d2f487c40f0ce8093efb178"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cacf227f6c9070a14ef94fe502964c3c884904871bfd7889b2164574086c4bbd"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4fa115afcf4d566a0ad587878f16cc765c4eeac4149bda6645388884afef0a06"}
{"level":"info","ts":"2026-07-10T13:35:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7b84183e4e8aa309577ff1d7d5b39eb62d62cee44f62183a1926614a20dea162"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42798","PortSpecifier":{"PortValue":42798}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42798","PortSpecifier":{"PortValue":42798}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":116693903},"http":{"id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","method":"POST","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a8811274-94b4-4a24-90d9-dfd78eeb4a63","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42806","PortSpecifier":{"PortValue":42806}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b91d596c-e91a-45bf-9657-259ac82ece96","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42806","PortSpecifier":{"PortValue":42806}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":169487678},"http":{"id":"b91d596c-e91a-45bf-9657-259ac82ece96","method":"POST","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b91d596c-e91a-45bf-9657-259ac82ece96","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"89744474-0b31-4134-832b-ecb923251fed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42822","PortSpecifier":{"PortValue":42822}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"89744474-0b31-4134-832b-ecb923251fed","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"89744474-0b31-4134-832b-ecb923251fed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42822","PortSpecifier":{"PortValue":42822}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":584219116},"http":{"id":"89744474-0b31-4134-832b-ecb923251fed","method":"POST","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"89744474-0b31-4134-832b-ecb923251fed","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"89744474-0b31-4134-832b-ecb923251fed","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"89744474-0b31-4134-832b-ecb923251fed","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89744474-0b31-4134-832b-ecb923251fed","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89744474-0b31-4134-832b-ecb923251fed","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89744474-0b31-4134-832b-ecb923251fed","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"89744474-0b31-4134-832b-ecb923251fed","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89744474-0b31-4134-832b-ecb923251fed","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89744474-0b31-4134-832b-ecb923251fed","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"89744474-0b31-4134-832b-ecb923251fed","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"89744474-0b31-4134-832b-ecb923251fed","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42838","PortSpecifier":{"PortValue":42838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42838","PortSpecifier":{"PortValue":42838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":631155735},"http":{"id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","method":"POST","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b51da45b-cd43-4bf6-b3a7-f21563c56046","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42854","PortSpecifier":{"PortValue":42854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42854","PortSpecifier":{"PortValue":42854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":664998452},"http":{"id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","method":"GET","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-pUEZj4Yo37cF7j6E_O4297Vxtn7109yVl8fMnbgWpAV4PMEOjBf20vu7Xkwj"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-pUEZj4Yo37cF7j6E_O4297Vxtn7109yVl8fMnbgWpAV4PMEOjBf20vu7Xkwj\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2f60bfbf-de00-4bcc-a234-a4172d281db2","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"2f60bfbf-de00-4bcc-a234-a4172d281db2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5cb71c6-117b-4b66-8da1-d7cf63757135","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":692993097},"http":{"id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-pUEZj4Yo37cF7j6E_O4297Vxtn7109yVl8fMnbgWpAV4PMEOjBf20vu7Xkwj"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-pUEZj4Yo37cF7j6E_O4297Vxtn7109yVl8fMnbgWpAV4PMEOjBf20vu7Xkwj\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2f60bfbf-de00-4bcc-a234-a4172d281db2","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"2f60bfbf-de00-4bcc-a234-a4172d281db2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-pUEZj4Yo37cF7j6E_O4297Vxtn7109yVl8fMnbgWpAV4PMEOjBf20vu7Xkwj","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ZGY5YjRmODktbjVkODQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.52~maas-default-gateway-openshift-default-5df9b4f89-n5d84.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.28","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"f72af042-0a4b-4949-a0b1-b0794952d7c4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":692993097,"seconds":1783690502},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.28:59742","port":59742}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"2f60bfbf-de00-4bcc-a234-a4172d281db2","keyName":"e2e-revoketest-a-0","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f72af042-0a4b-4949-a0b1-b0794952d7c4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42860","PortSpecifier":{"PortValue":42860}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42860","PortSpecifier":{"PortValue":42860}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":728988657},"http":{"id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","method":"GET","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1KqWfuRTK1QmWZvJa_xEZzoeXREp2qXYh7YXsF3SAPFGSHybkWCbjTLTRUey7"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1KqWfuRTK1QmWZvJa_xEZzoeXREp2qXYh7YXsF3SAPFGSHybkWCbjTLTRUey7\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e6f16cbc-145f-4339-9a28-8e13d7ff632b","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"e6f16cbc-145f-4339-9a28-8e13d7ff632b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7f4b4e69-ba55-4f37-ac5b-b7b030906fda","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":736873174},"http":{"id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1KqWfuRTK1QmWZvJa_xEZzoeXREp2qXYh7YXsF3SAPFGSHybkWCbjTLTRUey7"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1KqWfuRTK1QmWZvJa_xEZzoeXREp2qXYh7YXsF3SAPFGSHybkWCbjTLTRUey7\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e6f16cbc-145f-4339-9a28-8e13d7ff632b","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"e6f16cbc-145f-4339-9a28-8e13d7ff632b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1KqWfuRTK1QmWZvJa_xEZzoeXREp2qXYh7YXsF3SAPFGSHybkWCbjTLTRUey7","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ZGY5YjRmODktbjVkODQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.52~maas-default-gateway-openshift-default-5df9b4f89-n5d84.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.28","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"9b752a4b-e97f-4903-beb5-5cfb742259b0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":736873174,"seconds":1783690502},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.28:59742","port":59742}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e6f16cbc-145f-4339-9a28-8e13d7ff632b","keyName":"e2e-revoketest-a-1","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b752a4b-e97f-4903-beb5-5cfb742259b0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42862","PortSpecifier":{"PortValue":42862}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42862","PortSpecifier":{"PortValue":42862}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":773504728},"http":{"id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","method":"GET","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"92c1063b-96f4-4900-9e24-3f8eae9460c4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"42e527a1-48ce-43d0-9e42-c07989cee150","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":781068804},"http":{"id":"42e527a1-48ce-43d0-9e42-c07989cee150","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ZGY5YjRmODktbjVkODQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.52~maas-default-gateway-openshift-default-5df9b4f89-n5d84.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.28","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"42e527a1-48ce-43d0-9e42-c07989cee150"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"42e527a1-48ce-43d0-9e42-c07989cee150","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":781068804,"seconds":1783690502},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.28:59742","port":59742}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42e527a1-48ce-43d0-9e42-c07989cee150","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42872","PortSpecifier":{"PortValue":42872}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42872","PortSpecifier":{"PortValue":42872}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":812798550},"http":{"id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","method":"GET","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30753f99-0ca5-4715-af86-a19ee3a1dc2c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690502,"nanos":820273676},"http":{"id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ZGY5YjRmODktbjVkODQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.52~maas-default-gateway-openshift-default-5df9b4f89-n5d84.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.28","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":820273676,"seconds":1783690502},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.28:59742","port":59742}}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3df8f063-9cd7-4c45-9810-9b7b629bc2ba","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37428","PortSpecifier":{"PortValue":37428}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6a800cad-0163-439d-ba3c-dbadb3d45724","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37428","PortSpecifier":{"PortValue":37428}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690510,"nanos":32581616},"http":{"id":"6a800cad-0163-439d-ba3c-dbadb3d45724","method":"GET","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-pUEZj4Yo37cF7j6E_O4297Vxtn7109yVl8fMnbgWpAV4PMEOjBf20vu7Xkwj"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-pUEZj4Yo37cF7j6E_O4297Vxtn7109yVl8fMnbgWpAV4PMEOjBf20vu7Xkwj\"}"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2f60bfbf-de00-4bcc-a234-a4172d281db2","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"2f60bfbf-de00-4bcc-a234-a4172d281db2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6a800cad-0163-439d-ba3c-dbadb3d45724","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37430","PortSpecifier":{"PortValue":37430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37430","PortSpecifier":{"PortValue":37430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690510,"nanos":64019468},"http":{"id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","method":"GET","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1KqWfuRTK1QmWZvJa_xEZzoeXREp2qXYh7YXsF3SAPFGSHybkWCbjTLTRUey7"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1KqWfuRTK1QmWZvJa_xEZzoeXREp2qXYh7YXsF3SAPFGSHybkWCbjTLTRUey7\"}"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e6f16cbc-145f-4339-9a28-8e13d7ff632b","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"e6f16cbc-145f-4339-9a28-8e13d7ff632b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c2a99649-bdc1-4085-a2b2-237fc0d2cefa","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37434","PortSpecifier":{"PortValue":37434}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37434","PortSpecifier":{"PortValue":37434}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690510,"nanos":92559123},"http":{"id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","method":"GET","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE\"}"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5580cc60-6e4a-4c99-b4bd-120b6308f62e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690510,"nanos":99881860},"http":{"id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE\"}"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-9ZbOpD5kqC0DBvMk_2Dpk8jzND4g4NQ2qVv2jumrJSUB2YlpypCX31EC6MkE","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ZGY5YjRmODktbjVkODQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.52~maas-default-gateway-openshift-default-5df9b4f89-n5d84.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.28","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"6a6e187d-bab1-488d-a960-e1bf737bd68d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":99881860,"seconds":1783690510},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.28:59742","port":59742}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"532884af-07bb-4c5e-8a3b-53a0636bc15e","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6a6e187d-bab1-488d-a960-e1bf737bd68d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37446","PortSpecifier":{"PortValue":37446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37446","PortSpecifier":{"PortValue":37446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690510,"nanos":132801218},"http":{"id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","method":"GET","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y\"}"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4b98e56e-7daf-48ed-8b18-5fbfad8fca5a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c51f6669-c420-4def-99b4-dac461537d19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c51f6669-c420-4def-99b4-dac461537d19","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c51f6669-c420-4def-99b4-dac461537d19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:59742","PortSpecifier":{"PortValue":59742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690510,"nanos":139829997},"http":{"id":"c51f6669-c420-4def-99b4-dac461537d19","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y\"}"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c51f6669-c420-4def-99b4-dac461537d19","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-dUOCGcp44aOYlUFO_5TmB4KsA6r0Ru02TUrB8evaTTzRH4JcVZtpo8bNyA8y","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ZGY5YjRmODktbjVkODQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.52~maas-default-gateway-openshift-default-5df9b4f89-n5d84.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.28","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"c51f6669-c420-4def-99b4-dac461537d19"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c51f6669-c420-4def-99b4-dac461537d19","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":139829997,"seconds":1783690510},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.28:59742","port":59742}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c51f6669-c420-4def-99b4-dac461537d19","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"baf233ab-9d2c-4b23-bd8a-a2497aef6876","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c51f6669-c420-4def-99b4-dac461537d19","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c51f6669-c420-4def-99b4-dac461537d19","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37448","PortSpecifier":{"PortValue":37448}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c73f284a-6228-4860-9ab6-7edd5a54307b","method":"DELETE","path":"/maas-api/v1/api-keys/532884af-07bb-4c5e-8a3b-53a0636bc15e","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37448","PortSpecifier":{"PortValue":37448}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690510,"nanos":176107556},"http":{"id":"c73f284a-6228-4860-9ab6-7edd5a54307b","method":"DELETE","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/532884af-07bb-4c5e-8a3b-53a0636bc15e",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/532884af-07bb-4c5e-8a3b-53a0636bc15e",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c73f284a-6228-4860-9ab6-7edd5a54307b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37460","PortSpecifier":{"PortValue":37460}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a90d833a-5324-4e5b-abb9-58c1008fa817","method":"DELETE","path":"/maas-api/v1/api-keys/baf233ab-9d2c-4b23-bd8a-a2497aef6876","host":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:37460","PortSpecifier":{"PortValue":37460}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.52:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783690510,"nanos":210116405},"http":{"id":"a90d833a-5324-4e5b-abb9-58c1008fa817","method":"DELETE","headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/baf233ab-9d2c-4b23-bd8a-a2497aef6876",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"]}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e92ae5e721a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=17a25dc4-1f5a-49ed-bf33-6a902e3baa4c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"30478ab5-c7ea-40c8-9e8d-f64ec38c7509","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.52:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.f7976b8f-f353-4572-9b29-7e92ae5e721a.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/baf233ab-9d2c-4b23-bd8a-a2497aef6876",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T13:35:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a90d833a-5324-4e5b-abb9-58c1008fa817","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T13:35:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6174a4312dcd91316e8b6f4b76da5a198bc9af048898c6dee6032d8f6efb8404"}
{"level":"info","ts":"2026-07-10T13:35:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7ed7eecbcae67138e2b1b8fd6ab967255bbcc3bcc4d52e7a62d64aa3677a6af8"}
{"level":"info","ts":"2026-07-10T13:35:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/646d4db228e97abac840c2e58a53b53733ee3fd0341669fae32a333e1ab00400"}
{"level":"info","ts":"2026-07-10T13:35:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bbec1d90921f61a419f03c52292ab6cda6729c1953b2c1cae39a26e4385779e6"}
{"level":"info","ts":"2026-07-10T13:35:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/479ab36ec33dab889d17b8b44eafbb4e9086ac65d6b6af3b508af50985a2f913"}
{"level":"info","ts":"2026-07-10T13:35:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b12fc5e9698a384d8c3ca77532eaee446327e4cf29328cb2a54d2e76982e2d9f"}
{"level":"info","ts":"2026-07-10T13:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/52ab95c8699bea1e14c293054c027f332bfecba735a08fe9a6f485fc67bccfc8"}
{"level":"info","ts":"2026-07-10T13:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2f650611638ebe7b3b52ce7dd71c8f69c79a5c9fb8e3d64acfe9eb61654ae71c"}